> ## Documentation Index
> Fetch the complete documentation index at: https://vulhunt-docs.binarly.io/llms.txt
> Use this file to discover all available pages before exploring further.

# CalleesMatchingParam

The `CalleesMatchingParam` object defines the parameters used to enumerate and annotate specified function callees.
It is used with the [`ProjectHandle:callees_matching`](/vulhunt-reference/types/project-handle) method to filter and analyze call sites based on function names, predicates, and dataflow annotations.

### Fields

| Field   | Description                                                             | Type                                                                                                                                 |
| :------ | :---------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------- |
| `from`  | Function(s) whose callees are enumerated                                | `string`, [`AddressValue`](/vulhunt-reference/types/address-value), or [`CallsFromQuery`](/vulhunt-reference/types/calls-from-query) |
| `where` | Predicate function to filter function callees                           | `fun(callee: FunctionContext)`                                                                                                       |
| `using` | Lua expression specifying parameter annotations for the dataflow engine | Lua expression                                                                                                                       |
| `debug` | Enables debug logs for the matching process                             | `boolean`                                                                                                                            |

### Reference

#### from

The function(s) whose callees are enumerated. It can be a string (function name), an [`AddressValue`](/vulhunt-reference/types/address-value) (function address), or a [`CallsFromQuery`](/vulhunt-reference/types/calls-from-query) with pattern matching options.

#### where

A Lua function used to filter callees. Receives a [`FunctionContext`](/vulhunt-reference/types/function-context) object and should return `true` for callees to include.

#### using

A Lua expression specifying how to annotate parameters and callees for dataflow analysis.

* `parameters` assigns annotations to the parameters of the function being analyzed. For example: `parameters = {var:named "src", var:named "dst"}`
* `callees` assigns annotations to parameters and return values of functions called within the analyzed function. For example `callees = { FunctionName = {output = ..., inputs = {...}} }`

<Note>Do not use the same annotation name multiple times.</Note>

#### debug

If set to `true`, enables debug logging for the matching process.

### Example

The following example finds all callees of `process_request` named `target` that also call `malloc`.
It annotates parameters and callees for dataflow tracking.

```lua theme={null}
local results = project:callees_matching({
  from = "process_request",
  where = function(callee)
    return callee:named "target" and callee:has_call "malloc"
  end,
  using = {
    parameters = {var:named "name", var:named "value"},
    callees = {
      ["malloc"] = {output = var:named "env", inputs = {_}},
      ["strlen"] = {output = var:named "len", inputs = {_}}
    }
  }
})
```